MFA looping on Account Verification Code for Entra External ID Conditional Access triggered resource for Invited External User

Question

MFA looping on Account Verification Code for Entra External ID Conditional Access triggered resource for Invited External User

Kevin Russell 20

No Microsoft Organisational Users can access out custom web application that is secured using Microsoft Entra External ID. We have a Conditional Access policy in place that applies MFA for everyone that accesses the web application. When externally invited users access the web application they are first asked to enter their password, then they are given the option to have a verification code send to their email address. Once they select this option, and apply the verification code to the Microsoft dialog text field it gets verified and the option to option to have a verification code send to the email address reappears. This occurs indefinitely!

I would be greatly for any assistance

Thanks

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello Kevin Russell,

Thanks for posting your question in Microsoft Q&A!

Sometimes, when users from other organizations (who are guests in your Entra External ID tenant) sign in to your app, they get stuck in a loop. They enter a verification code sent to their email, but after entering it, the same prompt to enter another code just keeps coming back.

This happens mainly because of how MFA trust is set up between different organizations:

Your tenant currently does not trust the MFA methods that external users have already set up in their own home tenants.
Instead, the system makes these users register or verify MFA again in your tenant every time they sign in.
This can cause an endless cycle, especially if the verification method is email one-time passcode (OTP), which doesn’t work well as an MFA method for these guests.

To Mitigate the Issue:

Enable MFA Trust Between Tenants: In your Entra Admin Center, go to External Identities > Cross-tenant access settings and configure the trust so that your tenant accepts the MFA done by external users in their home tenants. This stops the need for them to verify MFA again and again.
Modify Conditional Access Settings: Review your Conditional Access policies to make sure they don’t enforce MFA in a way that conflicts with external user sessions. Also, tweak session lifetime and sign-in frequency settings for smoother access.
Use Supported MFA Methods: Switch from relying on email verification codes (Email OTP) as an MFA method. Instead, use Microsoft Authenticator or phone-based methods (SMS or phone call), which have better support for guests.
Reset MFA for Affected Users: For users stuck in the loop, you (or they) can reset their MFA settings in your tenant so they can register supported methods properly.
Check External Collaboration Settings: Make sure your guest user access settings and domain policies allow external users to authenticate without unnecessary restrictions.

Recommended Configuration:

Enable MFA trust for known partner organizations
Use Microsoft Authenticator as primary MFA method for external users
Configure SMS/Phone call as backup methods
Avoid Email OTP for MFA (use only for password reset)

Session Management Best Practices:

Set reasonable sign-in frequency (e.g., 8 hours for sensitive apps)
Configure persistent browser sessions appropriately
Monitor Conditional Access insights for policy effectiveness

Testing and Validation Test Scenario 1: MFA Trust Validation

Have an external user sign in to their home tenant first
Complete MFA in their home tenant
Then attempt to access your application
They should NOT be prompted for additional MFA if trust is configured correctly

Test Scenario 2: Authentication Method Verification

Verify users can register Microsoft Authenticator or phone-based methods
Confirm Email OTP is not being used as the primary MFA method
Test the complete sign-in flow end-to-end

Microsoft Reference Documents:

Cross-tenant access settings for B2B collaboration https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-settings-b2b-collaboration
Authentication and Conditional Access for External ID https://learn.microsoft.com/en-us/entra/external-id/authentication-conditional-access
Enforce multifactor authentication for B2B guest users https://learn.microsoft.com/en-us/entra/external-id/b2b-tutorial-require-mfa
Limitations of Email one-time passcode authentication https://learn.microsoft.com/en-us/entra/external-id/one-time-passcode
Troubleshooting sign-in problems with Conditional Access https://learn.microsoft.com/en-us/entra/identity/conditional-access/troubleshoot-conditional-access

Kindly let us know if the above helps or you need further assistance on this issue.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Kevin Russell 20 Reputation points

2025-09-28T07:02:56.1933333+00:00

Hi Sreetheja

I am unable to enable MFA trust between tenants, When I browse to the "External Identities\Cross-tenant access settings" page in our Entra External ID tenancy I see the message "This feature is unavailable or doesn't apply to the current tenant configuration"
Sreetheja Adusumilli 965 Reputation points Microsoft External Staff Moderator

2025-09-29T15:50:31.36+00:00

Hello Kevin Russell, The reason you’re seeing the message "This feature is unavailable or doesn't apply" when trying to enable MFA trust in Cross-tenant access settings is because your tenant is set up as an External ID tenant, not a Workforce tenant.

Here's the key difference:

External ID tenants are mainly for apps used by consumers or business customers. They don’t support Cross-tenant access settings or MFA trust like Workforce tenants do.

Workforce tenants are designed for managing employees and business partners and support these advanced cross-tenant features, including MFA trust.

Since External ID tenants don’t support this feature, you can’t enable MFA trust between tenants here.

Work Around:

Avoid using email verification codes (OTP) for MFA as they don’t work well for external users.

Use supported MFA methods like Microsoft Authenticator or SMS instead.

Adjust your Conditional Access policies to require those supported MFA methods.

Also, configure sign-in frequency and session settings to reduce repeated MFA prompts.

If cross-tenant MFA trust is critical for your use case, you might want to consider switching to a Workforce tenant, which supports those features fully.Kindly let us know if the above helps or you need further assistance on this issue.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Kevin Russell 20 Reputation points

2025-09-30T07:58:45.96+00:00

Hi Sreetheja, Thanks for your assistance to date. Am I to conclude, as OTP doesn't work well and I do not want to use SMS, following MFA mechanisms in https://learn.microsoft.com/en-us/entra/external-id/customers/concept-supported-features-customers that I am unable to use MFA for Microsoft Organisation invited users within external entra id tenants? Thanks
Sreetheja Adusumilli 965 Reputation points Microsoft External Staff Moderator

2025-10-02T15:19:29.93+00:00

Hello Kevin Russell,

I totally understand your concern. In Entra External ID tenants, the MFA choices for invited Microsoft organization users are a bit limited. Right now, the main options available are email one-time passcodes or SMS. Since email OTP can sometimes be unreliable and you prefer not to use SMS, that does leave fewer alternatives.

More common MFA methods like Microsoft Authenticator or other app-based options aren’t supported for these external users in External ID tenants. Those are usually available only if you have a Workforce tenant.

So, if SMS and email OTP aren’t suitable for you, unfortunately there isn't another MFA method available at the moment for those external guests in this setup. If stronger MFA options are really important, sometimes moving to a Workforce tenant might be worth considering.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".